```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 395 Introduced in Senate (IS)]

<DOC>

118th CONGRESS
  1st Session
                                 S. 395

 To amend the Children's Online Privacy Protection Act of 1998 to give 
   Americans the option to delete personal information collected by 
internet operators as a result of the person's internet activity prior 
                               to age 13.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                           February 13, 2023

Mr. Durbin (for himself, Mr. Blumenthal, and Ms. Hirono) introduced the 
 following bill; which was read twice and referred to the Committee on 
                 Commerce, Science, and Transportation

_______________________________________________________________________

                                 A BILL

 
 To amend the Children's Online Privacy Protection Act of 1998 to give 
   Americans the option to delete personal information collected by 
internet operators as a result of the person's internet activity prior 
                               to age 13.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Clean Slate for Kids Online Act of 
2023''.

SEC. 2. ENHANCING THE CHILDREN'S ONLINE PRIVACY PROTECTION ACT OF 1998.

    (a) Definitions.--Section 1302 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6501) is amended by adding at the end 
the following:
            ``(13) Delete.--The term `delete' means to remove personal 
        information such that the information is not maintained in 
        retrievable form and cannot be retrieved in the normal course 
        of business.''.
    (b) Regulation of Unfair and Deceptive Acts and Practices in 
Connection With the Collection and Use of Personal Information From and 
About Children on the Internet.--Section 1303 of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
            (1) in subsection (a), by adding at the end the following:
            ``(3) Failure to delete.--It is unlawful for an operator of 
        a website or online service directed to children, or any 
        operator that has actual knowledge that it is collecting 
        personal information from a child, to fail to delete personal 
        information collected from or about a child if a request for 
        deletion is made pursuant to regulations prescribed under 
        subsection (e).''; and
            (2) by adding at the end the following:
    ``(e) Right of an Individual To Delete Personal Information 
Collected When the Person Was a Child.--
            ``(1) In general.--Not later than 1 year after the date of 
        enactment of this subsection, the Commission shall promulgate 
        under section 553 of title 5, United States Code, regulations 
        that require the operator of any website or online service 
        directed to children, or any operator that has actual knowledge 
        that it has collected personal information from a child or 
        maintains such personal information--
                    ``(A) to provide notice in a prominent place on the 
                website of how an individual over the age of 13, or a 
                legal guardian of an individual over the age of 13 
                acting with the knowledge and consent of the 
                individual, can request that the operator delete all 
                personal information in the possession of the operator 
                that was collected from or about the individual when 
                the individual was a child notwithstanding any parental 
                consent that may have been provided when the individual 
                was a child;
                    ``(B) to promptly delete all personal information 
                in the possession of the operator that was collected 
                from or about an individual when the individual was a 
                child when such deletion is requested by an individual 
                over the age of 13 or by the legal guardian of such 
                individual acting with the knowledge and consent of the 
                individual, notwithstanding any parental consent that 
                may have been provided when the individual was a child;
                    ``(C) to provide written confirmation of deletion, 
                after the deletion has occurred, to an individual or 
                legal guardian of such individual who has requested 
                such deletion pursuant to this subsection; and
                    ``(D) to except from deletion personal information 
                collected from or about a child--
                            ``(i) only to the extent that the personal 
                        information is necessary--
                                    ``(I) to respond to judicial 
                                process; or
                                    ``(II) to the extent permitted 
                                under any other provision of law, to 
                                provide information to law enforcement 
                                agencies or for an investigation on a 
                                matter related to public safety; and
                            ``(ii) if the operator retain such excepted 
                        personal information for only as long as 
                        reasonably necessary to fulfill the purpose for 
                        which the information has been excepted and 
                        that the excepted information not be used, 
                        disseminated or maintained in a form 
                        retrievable to anyone except for the purposes 
                        specified in this subparagraph.''.
    (c) Safe Harbors.--Section 1304 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6503) is amended--
            (1) in subsection (a), by striking ``section 1303(b)'' and 
        inserting ``subsections (b) and (e) of section 1303''; and
            (2) in subsection (b)(1), by striking ``subsection (b)'' 
        and inserting ``subsections (b) and (e)''.
    (d) Actions by States.--Section 1305(a)(1) of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6504(a)(1)) is amended by 
striking ``1303(b)'' and inserting ``subsection (b) or (e) of section 
1303''.
                                 <all>
```